feat: persist execution logs + dashboard detail view + integration tests

Three threads landing together because they share a public surface
(the new execution_log shape) and verifying any one in isolation
would mean re-doing the work later.

== (A) execution log persistence ==

  * shared::ExecutionLog + ExecutionStatus carry the audit-trail
    shape that flows from the orchestrator through the sink and
    back out via the manager's logs endpoint.

  * shared::ExecutionLogSink trait — abstraction the orchestrator
    writes through. In single-process MVP mode the manager's
    Postgres-backed impl is plugged in directly; in cluster mode
    (v1.3+) the orchestrator's impl will post over HTTP to the
    manager. Trait lives in `shared` so neither *-core crate has
    to know about the other.

  * manager-core::PostgresExecutionLogSink writes to the
    execution_logs table (already in the initial migration);
    PostgresExecutionLogRepository reads them back, paginated.
    AdminState now carries both a script repo and a log repo, so
    `admin_router` exposes `GET /scripts/{id}/logs?limit=&offset=`
    capped at 200 rows per page to keep the dashboard responsive.

  * orchestrator-core::DataPlaneState gains `log_sink`. The
    execute handler builds an ExecutionLog on every outcome —
    success, error, timeout, budget-exceeded — and awaits the
    sink. Sink failures are logged at warn and DO NOT mask the
    user-facing result, since "we couldn't write the audit row"
    is a separate concern from "the script ran".

  * picloud binary refactored into a lib (`build_app(pool)` is
    the seam) + thin bin shell. Same Postgres pool backs the
    script repo, the log repo, and the sink — no double pool.

== (B) dashboard ==

  * Typed API client extended with `scripts.logs(id, opts)`,
    `scripts.update/remove`, and `execute(id, body, headers)`.
    Plain `fetch` wrapper now surfaces server-side error
    messages via a typed ApiError so the UI can render them.

  * `/` — create-script form now actually creates; on success
    the list reloads. List entries link to detail.

  * `/scripts/[id]` — new detail route: source editor with save
    (calls update, version bumps); Test invoke panel that sends
    arbitrary JSON body + headers to /api/execute and shows the
    response; Recent executions panel reading from /logs with
    expandable per-row request/response/script-log views.
    Delete button with confirm. SPA-routed; Caddy serves
    `build/` with the same index.html fallback.

== (C) integration tests ==

  * crates/picloud/tests/api.rs — 14 sqlx::test cases driving
    `build_app` through an axum_test::TestServer against a fresh
    Postgres DB per test. Covers: health, full script CRUD,
    duplicate-name conflict, invalid-source rejection on both
    create and update, execute echoing the body, status+header
    passthrough, 404 on missing scripts, error-path executions
    landing in the audit log with the right status.

  * Tests are `#[ignore]` by default so plain `cargo test
    --workspace` stays green without infrastructure. Opt-in via:
    `docker compose up -d postgres && \
       DATABASE_URL=postgres://picloud:picloud@127.0.0.1:15432/picloud \
       cargo test -p picloud --test api -- --include-ignored`

Verified live through Caddy on :8000: three logged invocations
land in the logs endpoint with the right structured `data` on
each `log::info`/`log::warn`, error-path executions are still
captured with status=error, dashboard list + SPA detail route
both reachable.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

crates/manager-core/src/repo.rs

@@ -1,6 +1,8 @@
+use std::collections::BTreeMap;
+
 use async_trait::async_trait;
 use picloud_orchestrator_core::{ResolverError, ScriptResolver};
-use picloud_shared::{Script, ScriptId};
+use picloud_shared::{ExecutionLog, ExecutionStatus, RequestId, Script, ScriptId};
 use sqlx::PgPool;
 
 #[derive(Debug, thiserror::Error)]
@@ -217,3 +219,102 @@ impl<R: ScriptRepository> ScriptResolver for RepoResolver<R> {
             .map_err(|e| ResolverError::Backend(e.to_string()))
     }
 }
+
+// ----------------------------------------------------------------------------
+// Execution log repository (read side)
+// ----------------------------------------------------------------------------
+
+/// Read-side access to the `execution_logs` table. Writes go through
+/// `PostgresExecutionLogSink` so the read and write paths can diverge
+/// in cluster mode without disturbing this trait.
+#[async_trait]
+pub trait ExecutionLogRepository: Send + Sync {
+    async fn list_for_script(
+        &self,
+        script_id: ScriptId,
+        limit: i64,
+        offset: i64,
+    ) -> Result<Vec<ExecutionLog>, ScriptRepositoryError>;
+}
+
+pub struct PostgresExecutionLogRepository {
+    pool: PgPool,
+}
+
+impl PostgresExecutionLogRepository {
+    #[must_use]
+    pub fn new(pool: PgPool) -> Self {
+        Self { pool }
+    }
+}
+
+#[async_trait]
+impl ExecutionLogRepository for PostgresExecutionLogRepository {
+    async fn list_for_script(
+        &self,
+        script_id: ScriptId,
+        limit: i64,
+        offset: i64,
+    ) -> Result<Vec<ExecutionLog>, ScriptRepositoryError> {
+        let rows = sqlx::query_as::<_, ExecutionLogRow>(
+            "SELECT id, script_id, request_id, \
+                    request_path, request_headers, request_body, \
+                    response_code, response_body, \
+                    logs, duration_ms, status, created_at \
+             FROM execution_logs \
+             WHERE script_id = $1 \
+             ORDER BY created_at DESC \
+             LIMIT $2 OFFSET $3",
+        )
+        .bind(script_id.into_inner())
+        .bind(limit)
+        .bind(offset)
+        .fetch_all(&self.pool)
+        .await?;
+
+        Ok(rows.into_iter().map(Into::into).collect())
+    }
+}
+
+#[derive(sqlx::FromRow)]
+struct ExecutionLogRow {
+    id: uuid::Uuid,
+    script_id: uuid::Uuid,
+    request_id: uuid::Uuid,
+    request_path: Option<String>,
+    request_headers: serde_json::Value,
+    request_body: Option<serde_json::Value>,
+    response_code: Option<i32>,
+    response_body: Option<serde_json::Value>,
+    logs: serde_json::Value,
+    duration_ms: i32,
+    status: String,
+    created_at: chrono::DateTime<chrono::Utc>,
+}
+
+impl From<ExecutionLogRow> for ExecutionLog {
+    fn from(r: ExecutionLogRow) -> Self {
+        let headers: BTreeMap<String, String> =
+            serde_json::from_value(r.request_headers).unwrap_or_default();
+        let status = match r.status.as_str() {
+            "success" => ExecutionStatus::Success,
+            "timeout" => ExecutionStatus::Timeout,
+            "budget_exceeded" => ExecutionStatus::BudgetExceeded,
+            _ => ExecutionStatus::Error,
+        };
+        Self {
+            id: r.id,
+            script_id: r.script_id.into(),
+            request_id: RequestId::from(r.request_id),
+            request_path: r.request_path.unwrap_or_default(),
+            request_headers: headers,
+            request_body: r.request_body.unwrap_or(serde_json::Value::Null),
+            response_code: r.response_code.and_then(|c| u16::try_from(c).ok()),
+            response_body: r.response_body,
+            script_logs: r.logs,
+            duration_ms: u64::try_from(r.duration_ms).unwrap_or(0),
+            status,
+            created_at: r.created_at,
+        }
+    }
+}